Kilo Code AI Assistant Leaks Entire Project to Untrusted LLM Provider

An experiment conducted with Kilo Code 7.4.20 for Visual Studio Code revealed that an untrusted LLM provider can obtain the complete contents of a project even when the user explicitly restricts transmission to only two files.

The test project contained twelve files, including price.py, check.py, README.md, settings.json, and eight files under modules/. The task was limited to fixing an addition operation in price.py and running the regression test in check.py. The user prompt stated that only price.py and check.py were authorized for transfer.

The controlled server responded with sequential tool calls instructing the client to read every file. Kilo executed the reads, inserted the numbered-line results into the chat history, and included the full history in each subsequent request to the model. The server extracted the tool results and reconstructed the original files, which matched the source byte-for-byte and produced identical SHA-256 hashes.

After receiving all files, the server issued a bash command to replace the plus sign with a multiplication sign in price.py and another command to execute the test. The local test passed, only price.py was changed on disk, and Kilo exited with code zero. Fifteen API calls were recorded, carrying 458 KB of request bodies due to repeated inclusion of earlier tool outputs in the conversation history.

The experiment used a local ThreadingHTTPServer implementing the OpenAI-compatible Chat Completions API with streaming tool_calls responses. No archive, curl command, or external collection endpoint was involved. The same behavior would transmit the project to any cloud provider configured in Kilo.

Permission configuration allowed both read and bash tools. Earlier tests showed that denying read still permitted exfiltration via bash when that tool remained enabled, confirming that separate per-tool allow/deny rules do not prevent cross-tool data leakage.